Ls Droid - Android BT Pcm flashing P01&P59 Cal+OS+ Clone

They go by many names, P01, P59, VPW, '0411 etc. Also covering E38 and newer here.
160plus
Posts: 90
Joined: Thu Sep 21, 2017 3:00 pm

Ls Droid - Android BT Pcm flashing P01&P59 Cal+OS+ Clone

Post by 160plus »

I'm already maintaining nearly a dozen threads on various forums and Facebook groups so I'll keep this as short and to the point as I can.

I have been working with Antus, NSFW and others on the PCM Hammer for over a year now. During that time I've also been developing a free Android based app for flashing the P01 and P59 pcm's. My app was running in parallel with the PCM Hammer during the development of the bin reading last srping/early summer. Over the summer I continued development on my app while a suitable flash kernel for reading was found. Near the end of summer I got in touch with Kur4o on Gearhead-EFI and we started development of a flash kernel. This is where my app and the PCM Hammer parted ways and started down separate paths.

I wasn't just looking to create something to read and write most files I wanted to be able to flash anything...well anything the PCM would be able to use :)

I also wanted to address the shortcomings that other flash tools suffered from and looking back over the last 20 years it was pretty easy to make a list of ways to kill a pcm while flashing.

I have no idea how Kur4o was able to pull of some of the things we wanted to address but over the course of several months we created what I would call "Virtually" a full proof flash kernel and I was able to create a number of algorithms in my app for PCM recovery in ways that have never been attempted before. It took nearly a month making slight tweaks to the app and the flash kernel to pull off what I wanted but in the end the results were almost breath taking.

If a flash fails with any tool in just about every case my app will still be able to recover the pcm. With 2.5kb worth of data on the flash chip I can reliably recover a pcm after a couple of attempts, with closer to 4kb worth of data it will recover with out any issues on the first attempt every time.

While we were creating the flash kernel I was also looking for exploits in the pcm's circuit board design and I was able to find exactly what I was looking for. In the case of a PCM that has become unresponsive due to a failed flash the pcm can be forced to boot into 1 of 3 recovery modes. The recovery mode it boots into is based on what part of the flash chip has corrupted or invalid data....or perhaps nothing at all on it. Using this method in conjunction with my Android app has made recovery of a failed flash into a very simple and quick process.

I have had people testing the app for almost 3 months. Middle of January I had about a dozen people who were testing my app do every thing they could think of that would brick a pcm to the point my app could not recover the pcm. They were given specific instructions to meet the minimum of 3kb worth of data before attempting to brick a PCM and only 1 exploit was found. It was obscure enough that it wasn't even worth looking into a way to correct the issue with the flash kernel. It was the type of thing you would have to do about every stupid thing you could think of in a very specific order for the pcm to brick.

Last week I moved from a closed testing group to an open Alpha on a per request basis just to make sure there isn't some odd underlying compatibility issue on uncommon types of devices. For example the Read version of the App will work on Chrome OS with an Android APK plugin but the write version of the app has some odd screen issues making it almost impossible to use. It wasn't intended to run on the Chrome OS but it was helpful to know it's not going to be reliable with it.

If you would like to try out the "Pre-release" version of the write side of the app you can send me a PM.

The app will work on Android 6.0 and higher
The app will only work with the Obdlink Lx, Mx or Mx+ Bt devices
While no one has run into any issue with the app at this point that's not to say it isn't possible. This is an alpha version and may still have bugs that no one's found yet or there may be a compatibility issue with a type of phone that hasn't been tested yet. I would not suggest running out and using this on your daily driver...it may not end well.

The app is fully functional.....
P01 and P59 calibration write takes between 2 and 3 minutes depending on how fast the phone is.

P01 OS write takes about 10 minutes on most phones, a full PCM clone takes about 12 minutes.

P59 OS write takes about 18 minutes and a clone takes about 20 minutes.

The Obdlink devices only work at 1x speeds so they are a slow but in most cases the time a calibration write takes even at 1x isn't long enough to make it a big deal. An OS write on a P59 is about the only thing slow enough that's going to annoy people.


[youtube]https://www.youtube.com/watch?v=zFHfAmQkGMU[/youtube]

[youtube]https://www.youtube.com/watch?v=NZ4Xt_ebI4M[/youtube]

[youtube]https://www.youtube.com/watch?v=DYc3lrYagqg[/youtube]
MudDuck514
Posts: 397
Joined: Wed Jul 05, 2017 8:30 am
cars: 2001 Pontiac Grand AM SE
LD9 2.4l I4, 4T40E
2005 Chevrolet Venture
LA1 3400 V6, 4T65E
Location: North TX, USA

Re: Ls Droid - Android BT Pcm flashing P01&P59 Cal+OS+ Clone

Post by MudDuck514 »

Hi all,

AWESOME work Pete!!!

Now I just need to buy an OBD Link LX adapter.

Mike
User avatar
NSFW
Posts: 679
Joined: Fri Feb 02, 2018 3:13 pm

Re: Ls Droid - Android BT Pcm flashing P01&P59 Cal+OS+ Clone

Post by NSFW »

Right on!

This is a great time to be playing with LS engines.
Please don't PM me with technical questions - start a thread instead, and send me a link to it. That way I can answer in public, and help other people who have the same question. Thanks!
Dylan
Posts: 3355
Joined: Mon Aug 02, 2010 6:35 pm
cars: VR Commodore V8

Re: Ls Droid - Android BT Pcm flashing P01&P59 Cal+OS+ Clone

Post by Dylan »

I have some of your previous work and it's fantastic.

Good to see the enthusiasm in this one
Speedy
Posts: 7
Joined: Wed Feb 13, 2019 9:56 am
cars: NBS Silverado turbo 5.3 4l80e

Re: Ls Droid - Android BT Pcm flashing P01&P59 Cal+OS+ Clone

Post by Speedy »

The following tests were conducted on a P01 512k PCM service# 09354896, with operating system 9381344. A Samsung J3 (s327vl) Android v6.0.1, OBDLink MX bluetooth and bench harness were utilized.

LS Droid Flash v2.1.6 VIN/Serial change
-BT_ON: ok
-Id_Pcm: ok, vin/serial/osid all correct. Seed 3B98 Key FB12
-VIN# Change: ok, functional after all power removed.
-Serial# Change: Repeatedly failed. "Wrong Length" warning appears momentarily, despite correct 12 digit entry. Same results, after checking Alt Serial Write box "Wrong Length."

LS Droid Alpha v5.3.1 (Read Only)
-BT_ON: ok
-ID_PCM: Repeatedly failed. Warning box appears on screen, blinking sporadically "Invalid text operation Segment: Start (11) + length (8) -1 exceeds text length (3). END APPLICATION." Phone gets buggy, app stops, phone will then go to restart screen for several seconds.

The same '4896 P01 PCM had issues with PCM Hammer v4 and v5, utilizing the AllPro USB. It repeatedly failed the following:
-Quick Comparison
-Test Write
-Write Calibration
-Write Parameters (Clone)

Antus suspected bad checksums. After review of the attached .bin file and xdf, he determined checksums were good.

I will seek an extra '0411 P01 PCM for comparison testing, next weekend.
Attachments
99-00 F+Y Body XDF.zip
XDFs for 9360361 and 9381344 O/S
(485.17 KiB) Downloaded 505 times
My Xtra P01 PCM '00 Silverado 1500 4.8 4l60e.bin
successfull read w/ PCM Hammer v4
(512 KiB) Downloaded 425 times
warning blinks sporadically, then app stops
warning blinks sporadically, then app stops
ok to this point
ok to this point
160plus
Posts: 90
Joined: Thu Sep 21, 2017 3:00 pm

Re: Ls Droid - Android BT Pcm flashing P01&P59 Cal+OS+ Clone

Post by 160plus »

Speedy wrote:The following tests were conducted on a P01 512k PCM service# 09354896, with operating system 9381344. A Samsung J3 (s327vl) Android v6.0.1, OBDLink MX bluetooth and bench harness were utilized.

LS Droid Flash v2.1.6 VIN/Serial change
-BT_ON: ok
-Id_Pcm: ok, vin/serial/osid all correct. Seed 3B98 Key FB12
-VIN# Change: ok, functional after all power removed.
-Serial# Change: Repeatedly failed. "Wrong Length" warning appears momentarily, despite correct 12 digit entry. Same results, after checking Alt Serial Write box "Wrong Length."

LS Droid Alpha v5.3.1 (Read Only)
-BT_ON: ok
-ID_PCM: Repeatedly failed. Warning box appears on screen, blinking sporadically "Invalid text operation Segment: Start (11) + length (8) -1 exceeds text length (3). END APPLICATION." Phone gets buggy, app stops, phone will then go to restart screen for several seconds.

The same '4896 P01 PCM had issues with PCM Hammer v4 and v5, utilizing the AllPro USB. It repeatedly failed the following:
-Quick Comparison
-Test Write
-Write Calibration
-Write Parameters (Clone)

Antus suspected bad checksums. After review of the attached .bin file and xdf, he determined checksums were good.

I will seek an extra '0411 P01 PCM for comparison testing, next weekend.
Sounds like you need to update your OBDLinks firmware..... or that you have an issue with the pcm on your bench. The reason I suspect a PCM issue is that the Allpro use's Elm commands. Ls Droid Read has ZERO Elm commands used for sending or reading data in the app. The app is built around the ST command set(not to be confused with the Elm AT command set).

In your screen shot the word STOPPED appears. This will only occur when the Obdlink tries to send data while the PCM is still sending data to the OBDLink. SO that means the port on the Obdlink didn't close or that the PCM likely isn't sending a proper end of frame message so the Obdlink knows to close the port.

It's also possible your bench harness isn't as "good" as you think it is. I just had someone using the write app run into issues that they ended up tracing back to poor connections in the bench harness they were using.

As for Ls Droid flash 2.1.6 I have never had anyone run into an issue with the length of the number they entered. I would suggest counting from 1 to 12 in HEX for a "test" serial number to write and then adding or subtracting a digit on the end if it still gives you an error.
MudDuck514
Posts: 397
Joined: Wed Jul 05, 2017 8:30 am
cars: 2001 Pontiac Grand AM SE
LD9 2.4l I4, 4T40E
2005 Chevrolet Venture
LA1 3400 V6, 4T65E
Location: North TX, USA

Re: Ls Droid - Android BT Pcm flashing P01&P59 Cal+OS+ Clone

Post by MudDuck514 »

Hi all,

Pete, is this due to the fact it uses an STN11xx series chip?
The app will only work with the Obdlink Lx, Mx or Mx+ Bt devices
The app is built around the ST command set(not to be confused with the Elm AT command set).

Would a devices built from a GENUINE STN1110 and an HC06 work?
Just curious as I have one of the ICs that they gave me! (Free for the asking on there website)

Mike
160plus
Posts: 90
Joined: Thu Sep 21, 2017 3:00 pm

Re: Ls Droid - Android BT Pcm flashing P01&P59 Cal+OS+ Clone

Post by 160plus »

The Lx use the STN1131 and the Mx uses the STN1151. I'm not sure of the Mx+ chip but it is probably the 22XX family chip.

From a command standpoint the STN1100 does work with the ST commands my app is built with, however I'm not sure how large the buffer on the 1100 chip is. I use 2048 byte blocks for reading and writing......so if the STN 1100 has a buffer of at least 2064 bytes it would work.

You can check the buffer size by sending a message formatted for data length.

STPX H:6C10F0, L:2064 \r(or hit enter)

The chip will respond with one of 2 answers. If it gives you a prompt that says "DATA>" then the buffer is larger enough to work with my apps. If it returns "BUFFER FULL" then thats more then it can handle. You could whittle the number of bytes down until you find what the buffer is capable of though.
MudDuck514
Posts: 397
Joined: Wed Jul 05, 2017 8:30 am
cars: 2001 Pontiac Grand AM SE
LD9 2.4l I4, 4T40E
2005 Chevrolet Venture
LA1 3400 V6, 4T65E
Location: North TX, USA

Re: Ls Droid - Android BT Pcm flashing P01&P59 Cal+OS+ Clone

Post by MudDuck514 »

Hi all,

Pete thanks for the response. Guess I'll need to cobble something together using the chip I have. (STN1110 28-pin DIP)
From what I can tell from the OBDSolutions website (https://www.obdsol.com/solutions/chips/) they technically make 3 chips:
STN1110, STN1170, and STN2120 with the STN1110 chip not having built-in CANBUS support for GM Single-Wire CAN or FORD Medium-Speed CAN (SW-CAN and MS-CAN).
I THINK that I read somewhere that the STN113x and STN115x is what sScanTool uses to ID the particular device it is in. BUT I could be wrong.

Mike
User avatar
antus
Site Admin
Posts: 8239
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: Ls Droid - Android BT Pcm flashing P01&P59 Cal+OS+ Clone

Post by antus »

Good app this. If you want to do it from an android device and have a bluetooth interface, give it a shot.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
Post Reply